MAL-2026-14427
Dashboard / Malicious Package / MAL-2026-14427
MAL-2026-14427
Summary: Malicious code in chai-as-mno (npm)
Details: Source: amazon-inspector (2e94e194f078c230d6c6b15efcddc54b133fd52c890a55b0f8bdb4c680452381) The package name mimics `chai-as-promised` and its README, badges, and license text are copied from an unrelated project (`pino`), while the package.json description is unrelated boilerplate. The declared main `index.js` exports a trivial no-op Express middleware `(_req,_res,next)=>next()` and unconditionally executes `require('./lib/config')` at import time. `lib/config.js` is a ~4MB single-line file heavily obfuscated with an obfuscator.io string-array scheme (string array `d` of length 23971 with rotation, hex-named identifiers, nested decoder functions `j`/`T`, control-flow flattening, and ~40,000 inline-decoded strings). The visible surface API provides no legitimate reason to ship a multi-megabyte opaque blob as a `config` module, and merely requiring the package runs that payload in the installer's Node process. The combination of impersonation cover story, mismatched README/description, no-op public API, and an obfuscator.io-grade payload executed on `require` is the loader/dropper shape.
Affected packages
Package
Name: chai-as-mno
Purl: pkg:npm/chai-as-mno
Affected ranges
Type: N/A
Events:
